___CPPdebugHook
ftblksn
Static task
static1
Behavioral task
behavioral1
Sample
b8fc46996a3c5ef434d56c5e5abfa2dc_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b8fc46996a3c5ef434d56c5e5abfa2dc_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
b8fc46996a3c5ef434d56c5e5abfa2dc_JaffaCakes118
Size
236KB
MD5
b8fc46996a3c5ef434d56c5e5abfa2dc
SHA1
81e8be3d803c4d842277d963194c5833cc9a3d98
SHA256
2b1d60c373f3938b4f3b97ef9a7b3a38542b4128730bb16b4caa0c9798c751dd
SHA512
8f6e37640bef4f31379be99321021a79d839dfe339e4c5a9ec3f97ff58821a273274a8d6085be0687f693559f130bfe7904e8f88d2447928afd7a525cc8e6e67
SSDEEP
3072:3F24fliN+7XlmZKxbLYH1rhAwHL5K2W5QVgxwkFY:3F24flic7X8ZibLYHFhAkKZYgnY
Checks for missing Authenticode signature.
resource |
---|
b8fc46996a3c5ef434d56c5e5abfa2dc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseHandle
CreateFileA
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStrings
GetFileAttributesA
GetFileSize
GetFileType
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetFilePointer
SetHandleCount
SetLastError
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrlenA
GetFileVersionInfoA
GetFileVersionInfoSizeA
closesocket
gethostbyname
htons
setsockopt
CharLowerA
EnumThreadWindows
MessageBoxA
wsprintfA
___CPPdebugHook
ftblksn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ